{"record":{"id":"36ac97bace77d6fb","repo":"gchq/CyberChef","slug":"invalid-key-length-keyarray-length-bytes-asc","errorCode":null,"errorMessage":"Invalid key length: ${keyArray.length} bytes.\n\nAscon-Mac requires a key of exactly 16 bytes (128 bits).","messagePattern":"Invalid key length: (.+?) bytes\\.\n\nAscon-Mac requires a key of exactly 16 bytes \\(128 bits\\)\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/AsconMAC.mjs","lineNumber":50,"sourceCode":"                \"name\": \"Key\",\n                \"type\": \"toggleString\",\n                \"value\": \"\",\n                \"toggleValues\": [\"Hex\", \"UTF8\", \"Latin1\", \"Base64\"]\n            }\n        ];\n    }\n\n    /**\n     * @param {ArrayBuffer} input\n     * @param {Object[]} args\n     * @returns {string}\n     * @throws {OperationError} if invalid key length\n     */\n    run(input, args) {\n        const keyArray = Utils.convertToByteArray(args[0].string, args[0].option);\n\n        if (keyArray.length !== 16) {\n            throw new OperationError(`Invalid key length: ${keyArray.length} bytes.\n\nAscon-Mac requires a key of exactly 16 bytes (128 bits).`);\n        }\n\n        // Convert to Uint8Array for vendor Ascon implementation\n        const keyUint8 = new Uint8Array(keyArray);\n        const inputUint8 = new Uint8Array(input);\n\n        // Compute MAC (returns Uint8Array)\n        const macResult = AsconMac.mac(keyUint8, inputUint8);\n\n        // Convert to hex string\n        return toHexFast(macResult);\n    }\n\n}\n\nexport default AsconMAC;","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/AsconMAC.mjs#L32-L68","documentation":"Thrown by AsconMAC.run when the supplied key is not exactly 16 bytes (128 bits). Ascon-Mac (the MAC profile of Ascon) fixes the key at 128 bits, so keyArray.length === 16 is enforced before AsconMac.mac is called. The key is decoded via Utils.convertToByteArray using the input option, so length is measured in bytes after decoding.","triggerScenarios":"Supplying a key of any length other than 16 bytes: a short passphrase as UTF-8, a 32-byte key, or a hex/base64 value that decodes to != 16 bytes.","commonSituations":"Reusing an AES key of a different size; pasting a passphrase; miscounting the decoded byte length.","solutions":["Provide exactly 16 bytes of key material (32 hex chars).","Derive a 16-byte key from a passphrase using a KDF before AsconMAC.","Confirm the key input option matches the encoding."],"exampleFix":"// before\nchef.asconMAC(msg, { key: \"secret\", keyOption: \"UTF8\" });\n\n// after\nchef.asconMAC(msg, { key: \"00112233445566778899aabbccddeeff\", keyOption: \"Hex\" });","handlingStrategy":"validation","validationCode":"import Utils from \"src/core/Utils.mjs\";\nfunction assertAsconMacKey(keyStr, keyOption) {\n  const bytes = Utils.convertToByteArray(keyStr, keyOption);\n  if (bytes.length !== 16) throw new Error(`Ascon-Mac key must be 16 bytes, got ${bytes.length}`);\n  return bytes;\n}\nassertAsconMacKey(key, keyOption);","typeGuard":"function is16ByteHex(s) { return /^[0-9a-f]{32}$/i.test(s); }","tryCatchPattern":null,"preventionTips":["Use exactly 16 bytes (32 hex chars) for the Ascon-Mac key.","Derive keys from passphrases with a KDF.","Verify the input option matches the key encoding."],"tags":["crypto","mac","ascon","key-length"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}